Security- Engineer

Introduction

At IBM Infrastructure & Technology, we build and run the systems that keep the world moving. Our work spans high-resiliency mainframes, hybrid cloud platforms, networking, automation, and site reliability—delivering the performance, security, and scalability clients and industries rely on every day. In Infrastructure & Technology, you’ll tackle complex challenges through curiosity and teamwork, working with a wide range of technologies and colleagues worldwide to deliver resilient, future-ready solutions that fuel innovation. With continuous learning, career growth, and a supportive culture, IBM helps you develop expertise and shape the infrastructure driving progress.

Your Role And Responsibilities

As a seasoned Security Professional, you will ensure the security, regulatory readiness, risk management, and compliance of the organization. You will partner with multiple teams to operationalize security initiatives and provide regulatory guidance to account teams.

Your Primary Responsibilities Will Include

• Lead Cybersecurity Investigations: Participate in cybersecurity investigations, ensuring timely and effective incident responses, and review and approve root cause analysis and action plans.
• Deploy Data Privacy Regulations: Evaluate the effect of new data privacy regulations on our portfolio, deploy and monitor implementation, and develop dashboards to support regulatory operational activities.
• Provide Regulatory Guidance: Deliver help and guidance on regulations to account teams, supporting them in navigating complex regulatory requirements.
• Operationalize Security Projects: Partner with other teams to convert security projects into business-as-usual activities, ensuring smooth execution and ongoing management.
• Monitor Incident Trends: Analyze incident and action plan trends, recognize opportunities for improvement, and optimize the organization’s security posture.
  
  

Design, develop, test, and maintain scalable backend applications and automation tools using Python.

Develop secure REST APIs and backend services in alignment with secure coding best practices.

Execute and evaluate Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) scans.

Review and triage Mend vulnerability findings, and drive remediation through the PSIRT process.

Coordinate and support Security Risk Testing (SRT) and Penetration Testing activities.

Analyze security findings, determine false positives, prioritize true vulnerabilities, and collaborate with development squads to drive remediation.

Create, maintain, and continuously update product threat models as the application evolves.

Perform security design and architecture reviews to uncover potential risks and propose mitigation strategies.

Integrate security scanning and automation into CI/CD pipelines to support DevSecOps practices.

Collaborate with architects, developers, and security teams to incorporate security throughout the SDLC.

Serve as the security champion for the product by advocating secure coding practices and strengthening the overall security posture.

Preferred Education

Master's Degree

Required Technical And Professional Expertise

7+ years of hands-on experience in Python application development, including building scalable backend applications and REST APIs.

Strong Python programming skills, with experience in object-oriented design, debugging, performance optimization, and automation.

Hands-on experience with Application Security and Secure SDLC practices.

Hands-on experience with SAST, DAST, Mend (Software Composition Analysis), PSIRT processes, and Security Risk Testing (SRT).

Experience coordinating or supporting internal/external Penetration Testing activities.

Strong experience reviewing vulnerability reports, triaging security findings, identifying false positives, and driving remediation with development teams.

Hands-on experience creating, maintaining, and reviewing product threat models.

Strong knowledge of secure coding principles and common application security vulnerabilities.

Experience integrating security tools into CI/CD pipelines and DevSecOps workflows.

Experience with Git, CI/CD tools (Jenkins/GitHub Actions), and Agile software development practices.

Excellent analytical, problem-solving, communication, and stakeholder management skills.

Preferred Technical And Professional Experience

Experience with application security tools such as SonarQube, Burp Suite, ZAP, or equivalent.

Experience conducting architecture security reviews and security design assessments.

Experience with cloud-native applications, Docker, Kubernetes/OpenShift, and API security.

Familiarity with threat modeling tools would be advantageous.

Experience automating security validation and remediation using Python.

Knowledge of Infrastructure as Code (Terraform/Ansible) security.

Security certifications are an added advantage.

Experience working in Agile/Scrum teams and collaborating across global engineering organizations.